HIPAA Privacy Policies and Procedures
Uses and Disclosures of Protected Health Information

POLICY

The Department of Elder Affairs (DOEA), a Covered Entity, will not use or disclose Protected Health Information (PHI), except as permitted or required by HIPAA privacy regulation subpart E of Part 164 or subpart C of Part 160 and applicable state privacy laws.

Protected Health Information (abbreviated as “PHI”) is individually identifiable health information about:

1. A person’s physical or mental health or condition;
2. The provision of health care to a person; or
3. The payment for the provision of health care to a person; and the information that identifies the person, or can reasonably be used to identify the person.

Examples of Identifiers

Identifying data (a/k/a “an identifier”) is data that could reasonably be used to identify the person. Please note that identifiers include data that directly identifies the individual, as well as any relatives, employers, or household members.

The following are examples of identifiers:

1. Names;
2. All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes;
3. All elements of dates (except year) directly related to an individual, including birth date, admission date, discharge date, and date of death (the birth year of individuals age 90 and over is also an identifier).
4. Telephone numbers;
5. Fax numbers;
6. Electronic mail addresses;
7. Social security numbers;
8. Medical record numbers;
9. Health plan beneficiary numbers;
10. Account numbers;
11. Certificate/license numbers;
12. Vehicle identifiers and serial numbers, including license plate numbers;
13. Device identifiers and serial numbers;
14. Web Universal Resource Locators (URLs);
15. Internet Protocol (IP) address numbers;
16. Biometric identifiers, including fingerprints and voiceprints;
17. Full face photographic images and any comparable images; and
18. Any other unique identifying number, characteristic or code.

PHI Can Be in Any Form of Communication or Media

PHI includes written, electronic, and oral communications.

Past, Present and Future

PHI relates to an individual’s past, present or future health condition, health care, or the payment for health care.

Exclusions: (20 U.S.C., Chapter 31, Section 1232g)

Some types of health information are excluded from being considered PHI even if they can be used to identify the individual. The exclusions are:

1. Education records covered by the Family Educational Rights and Privacy Act;
2. Student health records (age 18 or over) maintained by a health care provider who is treating the student; and
3. Employment records held by a Covered Entity in its role as employer.

Medicaid Information

Apart from the requirements of HIPAA, federal Medicaid regulations restrict the use and disclosure of information concerning Medicaid program applicants and beneficiaries to purposes directly connected with the administration of the Medicaid State Plan. These purposes include:

1. Establishing eligibility;
2. Determining the amount of medical assistance;
3. Providing services to recipients; and,
4. Conducting or assisting an investigation, prosecution, or civil or criminal proceeding relating to the administration of the Medicaid State Plan.

1. Names and addresses;
2. Medical services provided;
3. Social and economic conditions or circumstances;
4. DOEA evaluation of personal information;
5. Medical data, including diagnosis and past history of disease or disability;
   
6. Any information received for verifying income eligibility and amount of medical assistance payments; and
7. Any information received in connection with the identification of legally liable third party resources.

State Law (Florida Statutes)

Older Americans Act §430.105, F.S.

Community Care for the Elderly §430.207, F.S.

Alzheimer’s Disease Initiative §430.504, F.S.

Home Care for the Elderly §430.608, F.S.

PROCEDURE FOR APPROPRIATE USE OF PHI

Employees using or disclosing Medicaid beneficiary information are required to follow the requirements of both HIPAA and Medicaid law. Regardless of HIPAA, information about Medicaid recipients may only be disclosed for purposes directly connected with administering the Medicaid State Plan.

An employee, grantee or Business Associate may disclose PHI as described in their role in the normal course of performing their job. Employees, grantees or Business Associates may use and disclose PHI to any Business Associate or agency that has an agreement with the Department of Elder Affairs to protect health information. These would include, but not be limited to, Florida Agency of Health Care Administration, Florida Department of Health, Florida Department of Children & Families, Area Agencies on Aging, United States Department of Agriculture, Centers for Medicare & Medicaid Services (CMS), formerly called the Health Care Financing Administration (HCFA), and any vendors with whom the Department maintains a Business Associate agreement

Reference:

45 CFR § 164.502(a)
45 CFR § 164.501
45 CFR § 164.160.102
45 CFR § 164.514 (2)
20 U.S.C. 1232g
20 U.S.C. 1232g (a)(4)(B)(iv)
42 U.S.C.305

B) OTHER REQUIREMENTS

POLICY

This policy applies to all DOEA employees, agents and Business Associates that perform duties in conjunction with the access, distribution, dissemination, modification, and management of Protected Health Information (PHI).

It is DOEA’s policy to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule by establishing standards relating to uses and disclosures, and the de-identification of PHI.

Violation of this or any other DOEA Privacy Policy is to be communicated to the DOEA Privacy Officer, Office of the General Counsel.

PURPOSE

DOEA has established standards relating to uses and disclosures and de-identification of PHI it creates, collects and maintains.

PROCEDURE

Specific components/considerations:

A checklist has been developed containing all of the PHI identifiers in the Privacy Rule to use when de-identifying data.

1. Protected Health Information (PHI) is all individually identifiable health information (IIHI) transmitted or maintained by a Covered Entity,
   
2. Individually Identifiable Health Information (IIHI) contains some or all of the following elements:

1. Name
2. All address information regardless of form Protected Health Information (PHI) excludes IIHI in education records.
3. E-Mail Addresses
4. Dates (except year)
5. Social Security Number
6. Medical Record Numbers
7. Health Plan Beneficiary Numbers
8. Account Numbers
9. Certificate Numbers
10. License Numbers
11. Device Identifiers
12. URLs
13. IP Addresses
14. Facial Photographs
15. Biometric Identifiers, including fingerprints and voiceprints
16. The initial three digits of the zip code, unless the geographic unit formed by combining all zip codes with the initial three digits contains more than 20,000 people or the initial three digits of all geographic units with fewer than 20,000 people is changed to 000.
17. Any other unique identifying number, characteristic, or code.

c. The Covered Entity cannot actually have knowledge that the above information could be used alone or in combination with other information to identify the individual.

PHI will be re-identified for DOEA use or disclosure. Acceptable methods are redacting paper information, deleting electronic fields or locking aspects of files or database from viewing.

Violations must be reported to the DOEA Privacy Officer, Office of the General Counsel.

Verification:

Prior to any disclosure of PHI, DOEA employees must:

1. Verify the identity of a person requesting PHI, and the authority of the person to have access to the PHI (if the identity of the person is not known to the employee); and
2. Obtain any documentation, statements, or representations (whether oral or written) from the person requesting the PHI, when required as a condition of the disclosure.

Employees must follow the verification procedures of their individual work unit, which must, at minimum, comply with the above requirements of law.

Requests from legislators about a constituent’s PHI must be forwarded to the HIPAA Administrator.

Requests from public officials (law enforcement, etc.) concerning PHI should be forwarded to the Privacy Officer, Office of the General Counsel.

If an employee is uncertain whether a person has the authority to request PHI, or whether the person’s identity is adequately verified, the employee should consult with his or her supervisor, the Privacy Officer, Office of the General Counsel, or the HIPAA Administrator.

Reference:

45 CFR 164.514

C) DISCLOSURES FOR WHICH AN AUTHORIZATION IS REQUIRED

POLICY

DOEA, as a Covered Entity, will obtain authorization to use or disclose Protected Health Information (PHI) for purposes other than treatment, payment or health care operations.

Authorizations For Uses And Disclosures

1. General rule

Except as otherwise permitted or required by HIPAA, DOEA, as a Covered Entity, may not use or disclose Protected Health Information (PHI) without a valid authorization.

When DOEA obtains or receives a valid authorization for its use or disclosure of Protected Health Information (PHI), such use or disclosure must be consistent with such authorization.

2. Psychotherapy Notes

DOEA must obtain an authorization for any use or disclosure of psychotherapy notes, except for:

1. Use by the originator of the psychotherapy notes for treatment;
2. Use or disclosure by DOEA to defend itself in a legal action or other proceeding brought by the individual;
3. Use or disclosure by the Secretary of HHS in the course of an investigation or compliance review of DOEA
4. Use or disclosure required by law; or
5. Use or disclosure to a health oversight agency for oversight activities.

3. Marketing

DOEA, as a covered, entity must obtain an authorization for any use or disclosure of Protected Health Information (PHI) for marketing, except if the communication is in the form of:

1. A face-to-face communication made by a Covered Entity to an individual; or
2. A promotional gift of nominal value provided by the covered entity. If the marketing involves direct or indirect remuneration to the Covered Entity from a third party, the authorization must state that such remuneration is involved.

PROCEDURE

Employees shall obtain an authorization from the individual for any use or disclosure of psychotherapy notes for reasons other than listed above. If an employee is uncertain whether a particular use or disclosure of psychotherapy notes is permitted under a certain situation, the employee should consult with his or her supervisor or the Privacy Officer, General Counsel, or HIPAA Administrator prior to use or disclosure.

Implementation Specifications: General Requirements

(1) Valid authorizations

A valid authorization must be written in plain language, and include:

1. A description of the PHI to be used or disclosed in a specific and meaningful fashion;
2. The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure;
3. The name or other specific identification of the person(s), or class of persons, to whom DOEA may make the requested use or disclosure;
4. A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose;
5. An expiration date or an expiration event that relates to the individual or the purpose of the disclosure. The statement, “end of the research study,” “none,” or similar language is sufficient if the authorization is for the use or disclosure of PHI for research;
6. The signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual must be provided.
7. A statement of the individual’s right to revoke the authorization in writing, the exceptions to the right to revoke, and a description of how the individual may revoke the authorization;
8. A statement of the ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization; and
9. A statement of the potential for the information disclosed pursuant to the authorization to be subject to re-disclosure by the recipient and no longer protected by the Privacy Rule. An official DOEA Authorization form is available for use by employees.

(2) Defective authorizations

An authorization is not valid if the document submitted has any of the following defects:

1. The expiration date has passed or the expiration is known by DOEA to have occurred;
2. The authorization has not been filled out completely with respect to any material elements;
3. The authorization is known by DOEA to have been revoked;
4. The authorization is a compound authorization or a conditional authorization (except as set forth below); or,
5. Any of the material information in the authorization is known by DOEA to be false.
6. If an invalid form is received, a DOEA approved form is to be provided by the requestor.

(3) Compound authorizations

An authorization for use or disclosure of PHI may not be combined with any other document, except:

1. An authorization for the use or disclosure of PHI for a research study may be combined with any other type of written permission for the same research study;
2. An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes; and,
3. An authorization may be combined with another authorization, except when DOEA has conditioned the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of one of the authorizations.

(4) Prohibition on conditioning of authorizations

(5) Revocation of authorizations